ISACA CYBERSECURITY FUNDAMENTALS
CERTIFICATION EXAM 2026 PRACTICE
PAPER DETAILED QUESTIONS AND
ACCURATE ANSWERS STUDY RESOURCE
GRADED A+
⩥ Registration Authority (RA).
Answer: The individual institution that validates an entity's proof of
identity and ownership of a key pair.
⩥ cyberrisk assessment.
Answer: process of analyzing the different risk attributes:
1) Examine risk sources (threats/vulnerabilities) for positive/negative
consequences
2) Rank risks according to likelihood and impact
3) Evaluate existing controls to determine effectiveness of risk
mitigation
⩥ risk response options.
Answer: 1) Avoid - will not participate in an activity or business
2) Mitigate - implement controls to reduce likelihood or impact of risk to
organization's risk tolerance
,3) Share/Transfer - give risk to a 3rd party
4) Accept - if within organization's risk tolerance or cost is too high to
mitigate than absorb the loss
⩥ Vulnerability Management.
Answer: The practice of finding and mitigating software vulnerabilities
in computers and networks. Must understand where IT assets reside
(asset inventory). Once vulnerabilities are identified and assessed,
remediation begins to mitigate/eliminate the vulnerability (patch
management/changes to controls).
⩥ Vulnerability scanning.
Answer: process of using proprietary or open source tools to search for
known vulnerabilities; should be conducted regularly to identify new
vulnerabilities and ensure previously identified ones have been corrected
⩥ Exploit.
Answer: A method to take advantage of vulnerability by delivering input
to gain unintended access or deny service.
⩥ Types of Vulnerabilities.
Answer: 1) Technical (i.e. coding errors)
2) Process (i.e. failure to monitor logs)
3) Organizational (i.e. Lack of awareness/policies)
, 4) Emergent (i.e. implementing new tech)
⩥ Penetration testing.
Answer: Professional hacking to identify existing vulnerabilities and
then using known exploit methods to confirm exposures, assess
effectiveness of security controls, identify specific vulnerabilities to
assets, ensure compliance
⩥ Penetration testing phases.
Answer: 1) Planning - goals/scope are set and test is approved
2) Discovery - tester gathers information and vulnerability assessment is
conducted
3) Attack - attempting to exploit previously identified vulnerabilities
4) Reporting - report describing vulnerabilities, assigning risk rating, and
providing mitigation plans
⩥ Network management.
Answer: process of assessing, monitoring, and maintaining network
devices and connections; consists of 5 functional areas (FCAPS):
1) Fault management
2) Configuration management
3) Accounting management
4) Performance management
5) Security management
CERTIFICATION EXAM 2026 PRACTICE
PAPER DETAILED QUESTIONS AND
ACCURATE ANSWERS STUDY RESOURCE
GRADED A+
⩥ Registration Authority (RA).
Answer: The individual institution that validates an entity's proof of
identity and ownership of a key pair.
⩥ cyberrisk assessment.
Answer: process of analyzing the different risk attributes:
1) Examine risk sources (threats/vulnerabilities) for positive/negative
consequences
2) Rank risks according to likelihood and impact
3) Evaluate existing controls to determine effectiveness of risk
mitigation
⩥ risk response options.
Answer: 1) Avoid - will not participate in an activity or business
2) Mitigate - implement controls to reduce likelihood or impact of risk to
organization's risk tolerance
,3) Share/Transfer - give risk to a 3rd party
4) Accept - if within organization's risk tolerance or cost is too high to
mitigate than absorb the loss
⩥ Vulnerability Management.
Answer: The practice of finding and mitigating software vulnerabilities
in computers and networks. Must understand where IT assets reside
(asset inventory). Once vulnerabilities are identified and assessed,
remediation begins to mitigate/eliminate the vulnerability (patch
management/changes to controls).
⩥ Vulnerability scanning.
Answer: process of using proprietary or open source tools to search for
known vulnerabilities; should be conducted regularly to identify new
vulnerabilities and ensure previously identified ones have been corrected
⩥ Exploit.
Answer: A method to take advantage of vulnerability by delivering input
to gain unintended access or deny service.
⩥ Types of Vulnerabilities.
Answer: 1) Technical (i.e. coding errors)
2) Process (i.e. failure to monitor logs)
3) Organizational (i.e. Lack of awareness/policies)
, 4) Emergent (i.e. implementing new tech)
⩥ Penetration testing.
Answer: Professional hacking to identify existing vulnerabilities and
then using known exploit methods to confirm exposures, assess
effectiveness of security controls, identify specific vulnerabilities to
assets, ensure compliance
⩥ Penetration testing phases.
Answer: 1) Planning - goals/scope are set and test is approved
2) Discovery - tester gathers information and vulnerability assessment is
conducted
3) Attack - attempting to exploit previously identified vulnerabilities
4) Reporting - report describing vulnerabilities, assigning risk rating, and
providing mitigation plans
⩥ Network management.
Answer: process of assessing, monitoring, and maintaining network
devices and connections; consists of 5 functional areas (FCAPS):
1) Fault management
2) Configuration management
3) Accounting management
4) Performance management
5) Security management
